Service Trust Portal, Privacy Principles & Microsoft Priva
Where Microsoft proves its compliance, the six privacy promises it makes — and how Priva helps your organisation meet its own privacy obligations.
Where does Microsoft prove it’s trustworthy?
Think of a hotel’s hygiene rating certificate.
Before you stay at a hotel, you want proof it passed a health inspection. The certificate hanging on the wall tells you an independent inspector checked the kitchen, the rooms, and the fire escapes.
The Service Trust Portal is Microsoft’s version of that certificate wall. It’s a website where Microsoft publishes all its audit reports, compliance certificates, and security documentation so you can verify they meet the standards your industry requires.
Service Trust Portal
The Service Trust Portal is your one-stop shop for trust documentation. You sign in with your Microsoft cloud account and can access:
| Category | What You’ll Find |
|---|---|
| Certifications, Regulations & Standards | Audit reports proving Microsoft meets standards like ISO 27001, SOC 1/2/3, and FedRAMP |
| Reports, Whitepapers & Artefacts | Data protection documents, pen test results, FAQ documents |
| Industry & Regional Resources | Guidance tailored to specific industries (healthcare, finance) and regions (EU, Australia) |
| Resources for your Organisation | Documents specific to your tenant’s compliance status |
Key exam concept: The Service Trust Portal provides independent, third-party audit reports — not just Microsoft’s own claims. This is what makes it credible for regulatory purposes.
Scenario: Nadia needs proof for an auditor
Nadia, the Compliance Officer at MedGuard Health, receives a request from their external auditor: “Prove that Microsoft’s data centres meet ISO 27001 standards.”
Nadia doesn’t need to audit Microsoft herself. She goes to servicetrust.microsoft.com, downloads the latest ISO 27001 audit report (conducted by an independent assessor), and hands it to the auditor.
Without the Service Trust Portal, MedGuard would have to send a formal request to Microsoft and wait weeks. The portal makes this self-service.
Exam tip: Service Trust Portal access
You need to sign in with a Microsoft cloud account and accept a non-disclosure agreement the first time you access the portal. Not everything is publicly available — some documents require an authenticated session.
The exam may ask about what the portal contains. Remember the four categories: certifications, reports, industry resources, and resources for your organisation.
Microsoft’s six privacy principles
Microsoft commits to six privacy principles across all its cloud services. These aren’t just nice words — they’re backed by contractual agreements.
| Principle | What It Means |
|---|---|
| Control | You control your data. Microsoft gives you tools to manage, access, and delete your data |
| Transparency | Microsoft is clear about how it collects, uses, and shares data. Privacy statements are public |
| Security | Microsoft uses strong encryption and security practices to protect your data |
| Strong legal protections | Microsoft respects local privacy laws and fights government overreach for customer data |
| No content-based targeting | Microsoft does NOT scan your emails or documents to target you with advertising |
| Benefits to you | When Microsoft does collect data, it's used to improve your experience — not sold to third parties |
Key exam concept: The “no content-based targeting” principle is often tested. Microsoft does NOT use your email, chat, or document content to serve ads. This differentiates Microsoft 365 from free consumer services.
Data Protection Addendum (DPA)
The DPA is the contractual side of privacy. It’s a legal document that supplements your licensing agreement and details exactly how Microsoft processes customer data. It covers:
- What data Microsoft processes and why
- Microsoft’s security commitments
- Data breach notification obligations
- Sub-processor disclosure (third parties who touch your data)
- GDPR-specific provisions for EU customers
Scenario: Dr. Torres asks about patient data
Dr. Torres, MedGuard’s Chief Medical Officer, asks Nadia: “Can Microsoft read our patient records?”
Nadia shows him two things:
- The privacy principles — particularly “no content-based targeting” and “control”
- The DPA — the legal contract that prohibits Microsoft from accessing customer data for advertising and limits processing to providing the service
The DPA gives MedGuard legal recourse if Microsoft ever violated these commitments. It’s not just a promise — it’s a contract.
Microsoft Priva
While the privacy principles describe what Microsoft does, Priva helps your organisation manage its own privacy obligations.
Think of Priva as a privacy detective for your organisation.
Your company stores personal data about employees, customers, and patients. Privacy laws like GDPR say you must know where that data lives, who can access it, and you must respond quickly when someone says “delete my data.”
Priva scans your Microsoft 365 environment, finds personal data, flags privacy risks, and helps you respond to data requests — all from one dashboard.
Two sides of Priva
| Feature | Priva Privacy Risk Management | Priva Subject Rights Requests |
|---|---|---|
| Purpose | Proactively find and manage privacy risks | Respond to data subject access requests (DSARs) |
| How it works | Scans M365 for personal data, flags overexposed or over-retained data | Automates the search, collection, and review of personal data for a specific individual |
| Example | Alerts you that 500 files with SSNs are shared with external users | A patient asks 'what data do you have about me?' — Priva finds it all |
| Regulation link | GDPR Article 5 (data minimisation), Article 25 (privacy by design) | GDPR Article 15 (right of access), Article 17 (right to erasure) |
Scenario: Nadia handles a patient data request
A former patient contacts MedGuard: “Under the Privacy Act, I want to know what personal data you hold about me.”
Nadia opens Priva Subject Rights Requests and creates a new request for that individual. Priva automatically:
- Searches across Exchange, SharePoint, OneDrive, and Teams for that patient’s personal data
- Collects and de-duplicates results
- Flags items for Nadia to review before releasing
Instead of manually searching every system, Nadia has a complete picture in hours, not weeks. MedGuard meets the regulatory deadline with time to spare.
Exam tip: Priva vs Purview DLP
Don’t confuse Priva with DLP (Data Loss Prevention).
- Priva focuses on privacy — finding personal data, managing privacy risks, handling data subject requests
- DLP focuses on data protection — preventing sensitive data from being shared or leaked
Both deal with sensitive data, but from different angles. Priva answers “where is personal data and who can access it?” DLP answers “is someone trying to share sensitive data they shouldn’t?”
🎬 Video walkthrough
🎬 Video coming soon
Service Trust Portal, Privacy & Priva — SC-900 Domain 4.1
Service Trust Portal, Privacy & Priva — SC-900 Domain 4.1
~9 minFlashcards
Knowledge Check
Nadia's external auditor requires proof that Microsoft's cloud services meet ISO 27001 standards. Where should Nadia go to find this documentation?
A former patient requests that MedGuard Health provide all personal data the organisation holds about them. Which Microsoft tool should Nadia use to handle this efficiently?
Which Microsoft privacy principle states that your email and document content will NOT be used to target you with advertising?